ghostdock 0.0.18 → 0.0.20

package/dist/cli-reference.md

@@ -4,46 +4,46 @@
 
 Every command the `ghostdock` CLI ships, with its full description and flags.
 For how to install, log in and choose an organization, read [cli.md](cli.md). Concepts and
-workflows are in the built-in skills (`ghostdock skills list`).
+workflows are in the built-in skills (`ghostdock skill list`).
 
 Binaries: `ghostdock`, `gdock`.
 Global flag `--base-url`: API origin (overrides GHOSTDOCK_BASE_URL and the built-in default).
 Global flag `--json`: Print the result as one JSON document on stdout, for scripts and agents. Without it, output is for people.
 
-## `ghostdock apps`
+## `ghostdock app`
 
 Published apps of an organization.
 
-### `ghostdock apps list`
+### `ghostdock app list`
 
-List the live published apps (sites) of an organization, with their URLs. Each app has a siteId to pass to sites unpublish.
+List the live published apps (sites) of an organization, with their URLs. Each app has a siteId to pass to site unpublish.
 
 ```
-ghostdock apps list [flags]
+ghostdock app list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `apps_list`.
+MCP tool: `app_list`.
 
 ## `ghostdock docker`
 
-Docker over the private network: a sandbox's Docker engine from this machine.
+Docker over the private network: a VM's Docker engine from this machine.
 
 ### `ghostdock docker context`
 
-Point Docker at a sandbox's Docker engine over the private network: plain `docker` and `docker compose` then run there. Creates (or updates) the Docker context ghostdock-<org>-<sandbox> for tcp://<sandbox>.<org>.ghostdock.internal:2376 with a client certificate of this machine's device, and makes it the current context. Needs `ghostdock network connect` first, and Docker's CLI. The certificate lives 30 days; `network connect` and this command renew it with 10 days left. An expired certificate fails Docker's TLS handshake with Docker's own error: run this command again. Docker's `no such host` on a ghostdock.internal address means this machine is not connected: run `ghostdock network connect`. After an organization rename the old name stops resolving: run it again to update the host.
+Point Docker at a VM's Docker engine over the private network: plain `docker` and `docker compose` then run there. Creates (or updates) the Docker context ghostdock-<org>-<vm> for tcp://<vm>.<org>.ghostdock.internal:2376 with a client certificate of this machine's device, and makes it the current context. Needs `ghostdock network connect` first, and Docker's CLI. The certificate lives 30 days; `network connect` and this command renew it with 10 days left. An expired certificate fails Docker's TLS handshake with Docker's own error: run this command again. Docker's `no such host` on a ghostdock.internal address means this machine is not connected: run `ghostdock network connect`. After an organization rename the old name stops resolving: run it again to update the host.
 
 ```
-ghostdock docker context <sandbox> [flags]
+ghostdock docker context <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox>` | Sandbox name, from `network ls`. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `<vm>` | VM name, from `network ls`. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 | `--use` | Make it the current Docker context (`docker context use`). `--no-use` only creates or updates it. Default: `true`. |
 
 ## `ghostdock env`
@@ -61,7 +61,7 @@ ghostdock env delete <name> [flags]
 | Argument | Description |
 | --- | --- |
 | `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 
 MCP tool: `env_delete`.
 
@@ -76,7 +76,7 @@ ghostdock env get <name> [flags]
 | Argument | Description |
 | --- | --- |
 | `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 
 MCP tool: `env_get`.
 
@@ -90,7 +90,7 @@ ghostdock env list [flags]
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 
 MCP tool: `env_list`.
 
@@ -105,7 +105,7 @@ ghostdock env set <name> [flags]
 | Argument | Description |
 | --- | --- |
 | `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 | `--value <value>` | Value to store. |
 | `--value-stdin` | Read the value from stdin — keeps secrets out of shell history. |
 | `--secret` | Shorthand for --kind secret. Required when creating a secret. |
@@ -114,139 +114,139 @@ ghostdock env set <name> [flags]
 
 MCP tool: `env_set`.
 
-## `ghostdock images`
+## `ghostdock image`
 
 Organization image catalog: OCI bookmarks, Dockerfiles and Compose files.
 
-### `ghostdock images add`
+### `ghostdock image add`
 
 Bookmark an OCI image ref in the organization’s image catalog. Fails if it is already bookmarked.
 
 ```
-ghostdock images add --ref <string> [flags]
+ghostdock image add --ref <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--ref <string>` | OCI image reference, e.g. ghcr.io/acme/app:latest. Required. |
 | `--label <string>` | Display label for the bookmark. Optional. |
 
-MCP tool: `images_add`.
+MCP tool: `image_add`.
 
-### `ghostdock images add-compose`
+### `ghostdock image add-compose`
 
 Add a Compose project to the organization’s image catalog. Give its files, or a reference: a Compose project published as an OCI artifact (oci://…), used through include: with an optional override. ghostdock.* service labels (of the files, or of the override) become its manifest. Fails if the name is taken.
 
 ```
-ghostdock images add-compose --name <string> [flags]
+ghostdock image add-compose --name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--name <string>` | Image name, unique in the organization. Required. |
 | `--files <object>` | Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml. (JSON object) |
-| `--reference <string>` | A published Compose project instead of files, e.g. oci://docker.io/ghostdockhq/vm-compose:ubuntu-26.04. |
+| `--reference <string>` | A published Compose project instead of files, e.g. oci://docker.io/ghostdockhq/headless-compose:ubuntu-26.04. |
 | `--override <string>` | With reference: a Compose file merged into it (services, environment, labels). |
 
-MCP tool: `images_add_compose`.
+MCP tool: `image_add_compose`.
 
-### `ghostdock images add-dockerfile`
+### `ghostdock image add-dockerfile`
 
 Add a Dockerfile to the organization’s image catalog. ghostdock.* LABEL lines become its manifest. Fails if the name is taken.
 
 ```
-ghostdock images add-dockerfile --name <string> --dockerfile <string> [flags]
+ghostdock image add-dockerfile --name <string> --dockerfile <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--name <string>` | Image name, unique in the organization. Required. |
 | `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
 
-MCP tool: `images_add_dockerfile`.
+MCP tool: `image_add_dockerfile`.
 
-### `ghostdock images get`
+### `ghostdock image get`
 
 Get one catalog image with its spec, manifest and requirements. Returns kind, spec and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark’s manifest is null: its labels are read at create time.
 
 ```
-ghostdock images get <image-id> [flags]
+ghostdock image get <image-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<image-id>` | Catalog image id, from image list or image get. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `images_get`.
+MCP tool: `image_get`.
 
-### `ghostdock images list`
+### `ghostdock image list`
 
-List the images an organization can boot sandboxes from. OCI bookmarks, images add-dockerfile and images add-compose rows, and refs its sandboxes use. A discovery catalog, not an allowlist: sandboxes create accepts any OCI ref. Items carry sandboxCount and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark stores no labels (manifest null): sandboxes create reads them from the digest the ref names then.
+List the images an organization can boot VMs from. OCI bookmarks, image add-dockerfile and image add-compose rows, and refs its VMs use. A discovery catalog, not an allowlist: vm create accepts any OCI ref. Items carry vmCount and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark stores no labels (manifest null): vm create reads them from the digest the ref names then.
 
 ```
-ghostdock images list [flags]
+ghostdock image list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `images_list`.
+MCP tool: `image_list`.
 
-### `ghostdock images remove`
+### `ghostdock image remove`
 
-Remove an image from the organization’s catalog. Sandboxes already using it are not affected.
+Remove an image from the organization’s catalog. VMs already using it are not affected.
 
 ```
-ghostdock images remove <image-id> [flags]
+ghostdock image remove <image-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<image-id>` | Catalog image id, from image list or image get. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `images_remove`.
+MCP tool: `image_remove`.
 
-### `ghostdock images update-compose`
+### `ghostdock image update-compose`
 
 Replace a catalog Compose image’s files, reference, override and/or name. Re-parses its labels.
 
 ```
-ghostdock images update-compose <image-id> [flags]
+ghostdock image update-compose <image-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<image-id>` | Catalog image id, from image list or image get. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--files <object>` | New Compose files by file name. Omit to keep the current files. (JSON object) |
 | `--reference <string>` | A new reference (oci://…): the image becomes a Compose reference. |
 | `--override <string>` | A reference’s new override; null removes it. |
 | `--name <string>` | New image name. Omit to keep it. |
 
-MCP tool: `images_update_compose`.
+MCP tool: `image_update_compose`.
 
-### `ghostdock images update-dockerfile`
+### `ghostdock image update-dockerfile`
 
 Replace a catalog Dockerfile, optionally renaming it. Re-parses its ghostdock.* labels.
 
 ```
-ghostdock images update-dockerfile <image-id> --dockerfile <string> [flags]
+ghostdock image update-dockerfile <image-id> --dockerfile <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<image-id>` | Catalog image id, from image list or image get. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
 | `--name <string>` | New image name. Omit to keep it. |
 
-MCP tool: `images_update_dockerfile`.
+MCP tool: `image_update_dockerfile`.
 
 ## `ghostdock login`
 
@@ -273,7 +273,7 @@ ghostdock logout
 
 ## `ghostdock network`
 
-The private network: reach your sandboxes by address and name from this machine.
+The private network: reach your VMs by address and name from this machine.
 
 ### `ghostdock network connect`
 
@@ -285,8 +285,8 @@ ghostdock network connect [provider] [flags]
 
 | Argument | Description |
 | --- | --- |
-| `<provider>` | Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `<provider>` | Provider name or id. Omit for the organization's default provider (else the platform default). Only its VMs are reachable; connecting through another replaces the connection. |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 
 ### `ghostdock network devices`
 
@@ -318,7 +318,7 @@ ghostdock network disconnect
 
 ### `ghostdock network ls`
 
-Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection.
+VMs of an organization with their private addresses and names, and which are reachable through the current connection.
 
 ```
 ghostdock network ls [flags]
@@ -326,7 +326,7 @@ ghostdock network ls [flags]
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 
 ### `ghostdock network status`
 
@@ -336,38 +336,38 @@ Whether this machine is connected, through which provider, and as which device.
 ghostdock network status
 ```
 
-## `ghostdock organizations`
+## `ghostdock organization`
 
 Organizations you belong to.
 
-### `ghostdock organizations current`
+### `ghostdock organization current`
 
 Show which organization commands use, and where it comes from.
 
 ```
-ghostdock organizations current [flags]
+ghostdock organization current [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
 | `--org <value>` | Check what this --org would resolve to. |
 
-### `ghostdock organizations list`
+### `ghostdock organization list`
 
 List the organizations you belong to, with their ids and slugs.
 
 ```
-ghostdock organizations list
+ghostdock organization list
 ```
 
-MCP tool: `organizations_list`.
+MCP tool: `organization_list`.
 
-### `ghostdock organizations use`
+### `ghostdock organization use`
 
 Set the default organization for commands run without --org (in every directory).
 
 ```
-ghostdock organizations use [org] [flags]
+ghostdock organization use [org] [flags]
 ```
 
 | Argument | Description |
@@ -375,331 +375,331 @@ ghostdock organizations use [org] [flags]
 | `<org>` | Organization id or slug. |
 | `--clear` | Remove the default organization. |
 
-## `ghostdock projects`
+## `ghostdock project`
 
 Deployable projects, their deployments and environment.
 
-### `ghostdock projects create`
+### `ghostdock project create`
 
-Create an empty project. Nothing is deployed until projects publish.
+Create an empty project. Nothing is deployed until project publish.
 
 ```
-ghostdock projects create --display-name <string> [flags]
+ghostdock project create --display-name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--display-name <string>` | Project name. Required. |
 
-MCP tool: `projects_create`.
+MCP tool: `project_create`.
 
-### `ghostdock projects deployments`
+### `ghostdock project deployment`
 
 Deployments of a project.
 
-### `ghostdock projects deployments get`
+### `ghostdock project deployment get`
 
 Get one deploy attempt, with links to its stored files. fileUrls are authenticated GET paths for source.zip and generated Compose files.
 
 ```
-ghostdock projects deployments get <deployment-id> --project-id <string> [flags]
+ghostdock project deployment get <deployment-id> --project-id <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<deployment-id>` | Deployment id, from projects deployments list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+| `<deployment-id>` | Deployment id, from project deployment list. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--project-id <string>` | Project id, from project list (project publish returns it too). Required. |
 
-MCP tool: `projects_deployments_get`.
+MCP tool: `project_deployment_get`.
 
-### `ghostdock projects deployments list`
+### `ghostdock project deployment list`
 
 List a project’s deploy attempts, newest first.
 
 ```
-ghostdock projects deployments list <project-id> [flags]
+ghostdock project deployment list <project-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `projects_deployments_list`.
+MCP tool: `project_deployment_list`.
 
-### `ghostdock projects env`
+### `ghostdock project env`
 
 Environment a project exports.
 
-### `ghostdock projects env delete`
+### `ghostdock project env delete`
 
 Delete one of a project’s own variables or secrets.
 
 ```
-ghostdock projects env delete <name> --project-id <string> [flags]
+ghostdock project env delete <name> --project-id <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
 | `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--project-id <string>` | Project id, from project list (project publish returns it too). Required. |
 
-MCP tool: `projects_env_delete`.
+MCP tool: `project_env_delete`.
 
-### `ghostdock projects env get`
+### `ghostdock project env get`
 
 Get a project’s stored environment. Local entries (secret values withheld), organization opt-ins and bindings, applied on every deploy.
 
 ```
-ghostdock projects env get <project-id> [flags]
+ghostdock project env get <project-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `projects_env_get`.
+MCP tool: `project_env_get`.
 
-### `ghostdock projects env select`
+### `ghostdock project env select`
 
-Replace the organization entries a project exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Read the environment skill (`ghostdock skills get environment`).
+Replace the organization entries a project exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Read the environment skill (`ghostdock skill get environment`).
 
 ```
-ghostdock projects env select <project-id> --environment <array> [flags]
+ghostdock project env select <project-id> --environment <array> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--environment <array>` | Organization catalogue entry names to export under their own names. (JSON array) Required. |
 | `--bindings <array>` | Slot-centric org bindings. Omit to clear existing remaps. (JSON array) |
 
-MCP tool: `projects_env_select`.
+MCP tool: `project_env_select`.
 
-### `ghostdock projects env set`
+### `ghostdock project env set`
 
 Create or replace one of a project’s own variables or secrets. Prefer the CLI for secret values so they stay out of the conversation.
 
 ```
-ghostdock projects env set <name> --project-id <string> --value <string> --kind <string> [flags]
+ghostdock project env set <name> --project-id <string> --value <string> --kind <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
 | `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--project-id <string>` | Project id, from project list (project publish returns it too). Required. |
 | `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
 | `--kind <string>` | "variable" or "secret". A secret value can be replaced but never read back. Required. |
 | `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
 
-MCP tool: `projects_env_set`.
+MCP tool: `project_env_set`.
 
-### `ghostdock projects get`
+### `ghostdock project get`
 
 Get a project with its latest attempt and live deployment. latestDeploymentId includes failures; liveDeploymentId / liveUrl is the success that serves the public URL.
 
 ```
-ghostdock projects get <project-id> [flags]
+ghostdock project get <project-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `projects_get`.
+MCP tool: `project_get`.
 
-### `ghostdock projects list`
+### `ghostdock project list`
 
-List an organization’s projects. A project owns its environment, deployment history and live URL. apps list lists live URLs instead.
+List an organization’s projects. A project owns its environment, deployment history and live URL. app list lists live URLs instead.
 
 ```
-ghostdock projects list [flags]
+ghostdock project list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `projects_list`.
+MCP tool: `project_list`.
 
-### `ghostdock projects publish`
+### `ghostdock project publish`
 
-Inspect local source with the deploy agent and publish to the CDN or a sandbox.
+Inspect local source with the deploy agent and publish to the CDN or a VM.
 
 ```
-ghostdock projects publish [path] [flags]
+ghostdock project publish [path] [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
 | `--project-id <value>` | Existing project id. Omit to create a project. |
 | `--replan` | Force a new planner run even when the stored spec still matches. |
 | `--require-verify` | Fail the deploy (verify_failed) when detected tests fail. Default false: tests still run and are reported. |
-| `--spec <value>` | JSON DeploymentSpec to execute on a fresh sandbox instead of planning. Mutually exclusive with --replan. |
+| `--spec <value>` | JSON DeploymentSpec to execute on a fresh VM instead of planning. Mutually exclusive with --replan. |
 | `--display-name <value>` | Optional display name. |
 | `--tag <value>` | Optional caller tag (git SHA or free-form label) stored on the deployment. |
-| `--auto-stop-interval-minutes <value>` | Same as `sandboxes create`. Omit for the 20-minute default. Pass -1 to keep it running. 0 is rejected. |
-| `--auto-delete-interval-minutes <value>` | Same as `sandboxes create`. Omit for the 14-day default. Pass 0 to delete the record when it stops, or -1 to keep it. |
-| `--resources <value>` | Same as `sandboxes create`: JSON { cpu, memoryGiB, diskGiB }. |
-| `--environment <value>` | Same as `sandboxes create --environment`: JSON { organization, bindings, local }. Required after awaiting_configuration. |
-| `--auto-wake <value>` | Same as `sandboxes urls create --auto-wake`. Default true for the minted URL. |
-| `--public <value>` | Same as `sandboxes urls create --public`. Default true for the minted URL. |
-| `--sandbox-provider-id <value>` | Same as `sandboxes create`: configured sandbox-provider instance id (omit for the organization default). |
+| `--auto-stop-interval-minutes <value>` | Same as `vm create`. Omit for the 20-minute default. Pass -1 to keep it running. 0 is rejected. |
+| `--auto-delete-after-days <value>` | Same as `vm create`: days stopped before the record is deleted (0–365). Omit for the 14-day default. Pass 0 to delete the record when it stops. |
+| `--resources <value>` | Same as `vm create`: JSON { cpu, memoryGiB, diskGiB }. |
+| `--environment <value>` | Same as `vm create --environment`: JSON { organization, bindings, local }. Required after awaiting_configuration. |
+| `--auto-wake <value>` | Same as `vm url create --auto-wake`. Default true for the minted URL. |
+| `--public <value>` | Same as `vm url create --public`. Default true for the minted URL. |
+| `--provider <value>` | Same as `vm create`: configured provider instance id (omit for the organization default). |
 | `--zip <value>` | Local ZIP of the source tree. |
 | `<path>` | File or directory to publish (additional paths are allowed). |
 
-MCP tool: `projects_publish`.
+MCP tool: `project_publish`.
 
-### `ghostdock projects redeploy`
+### `ghostdock project redeploy`
 
-Deploy a project’s stored source again, with its current environment. No new upload. Omit deploymentId to retry the last attempt that stored source. Same outcomes and settings as projects publish; read the publishing skill (`ghostdock skills get publishing`).
+Deploy a project’s stored source again, with its current environment. No new upload. Omit deploymentId to retry the last attempt that stored source. Same outcomes and settings as project publish; read the publishing skill (`ghostdock skill get publishing`).
 
 ```
-ghostdock projects redeploy <project-id> [flags]
+ghostdock project redeploy <project-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--deployment-id <string>` | Ship this version’s stored upload and spec. Omit to retry the last attempt that stored source. |
-| `--require-verify` | When true, a failing verify step stops the deploy (verify_failed) and tears the sandbox down. Default false. |
+| `--require-verify` | When true, a failing verify step stops the deploy (verify_failed) and tears the VM down. Default false. |
 | `--tag <string>` | Optional caller tag stored on the new deployment. Metadata only. |
 | `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
-| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the platform worker deletes the record. 0 deletes it when it stops. -1 keeps it until a person deletes it. Omit for the platform default. Provider-native timers are optional backup. |
-| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
-| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
-| `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
-| `--auto-wake` | Same as urls[].autoWake on sandboxes create. Default true for the minted URL. |
-| `--public` | Same as urls[].public on sandboxes create. Default true for the minted URL. |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the VM. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
+| `--lifecycle <string>` | What may make the VM disappear on its own. ephemeral: every stop wipes the VM and its disk, and the next start runs its Compose project again (edits in the project folder kept, everything else gone; locks too). auto_delete (default): a stop keeps the disk, and the record goes autoDeleteAfterDays after the stop. keep: never removed automatically. Omit for the image label ghostdock.ephemeral, else auto_delete. ephemeral is chosen here only. |
+| `--auto-delete-after-days <integer>` | Days the VM stays stopped before the platform worker deletes the record (0–365; 0 deletes it when it stops). Omit for the platform default (14). Not with keep. A container a person locked holds it. |
+| `--provider <string>` | Provider id from provider list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new VMs and has it is used. When no provider fits, the call fails with a not-configured error. |
+| `--environment <object>` | Environment to give this VM. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: VM-only variables/secrets to create with the VM (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a VM gets nothing unless listed here. (JSON object) |
+| `--auto-wake` | Same as urls[].autoWake on vm create. Default true for the minted URL. |
+| `--public` | Same as urls[].public on vm create. Default true for the minted URL. |
 
-MCP tool: `projects_redeploy`.
+MCP tool: `project_redeploy`.
 
-### `ghostdock projects update`
+### `ghostdock project update`
 
 Rename a project.
 
 ```
-ghostdock projects update <project-id> --display-name <string> [flags]
+ghostdock project update <project-id> --display-name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<project-id>` | Project id, from project list (project publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--display-name <string>` | New name. Null or empty clears it. Required. |
 
-MCP tool: `projects_update`.
+MCP tool: `project_update`.
 
-## `ghostdock providers`
+## `ghostdock provider`
 
-Sandbox providers of an organization.
+Providers of an organization.
 
-### `ghostdock providers disconnect`
+### `ghostdock provider disconnect`
 
-Disconnect one of the organization’s own sandbox providers. Owner or admin. Fails while sandboxes still use it. If organization snapshots live on it, the first call fails: pass confirmLinkedDeletion to delete them permanently. Also frees its custom domain and removes incomplete Incus setups; a default provider falls back to the platform default.
+Disconnect one of the organization’s own providers. Owner or admin. Fails while VMs still use it. If organization snapshots live on it, the first call fails: pass confirmLinkedDeletion to delete them permanently. Also frees its custom domain and removes incomplete Incus setups; a default provider falls back to the platform default.
 
 ```
-ghostdock providers disconnect <sandbox-provider-id> [flags]
+ghostdock provider disconnect <provider> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<provider>` | Provider id, from provider list. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 | `--confirm-linked-deletion` | Required when this provider still has organization snapshots. Permanently deletes those snapshots, then disconnects. |
 
-MCP tool: `providers_disconnect`.
+MCP tool: `provider_disconnect`.
 
-### `ghostdock providers list`
+### `ghostdock provider list`
 
-List the sandbox providers an organization can create sandboxes on. Includes its own connected providers and the platform providers it may use, in fallback order. Use an item id as sandboxProviderId. Only items with acceptsNewSandboxes true take new sandboxes; an own provider stays incomplete until customDomain.status is active. defaultSandboxProviderId is the effective default. Read the sandboxes skill (`ghostdock skills get sandboxes`) for the details.
+List the providers an organization can create VMs on. Includes its own connected providers and the platform providers it may use, in fallback order. Use an item id as provider. Only items with acceptsNewVms true take new VMs; an own provider stays incomplete until customDomain.status is active. defaultProviderId is the effective default. Read the vm skill (`ghostdock skill get vm`) for the details.
 
 ```
-ghostdock providers list [flags]
+ghostdock provider list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `providers_list`.
+MCP tool: `provider_list`.
 
-### `ghostdock providers rename`
+### `ghostdock provider rename`
 
-Rename one of the organization’s own sandbox providers. Owner or admin. Platform providers cannot be renamed; names must be unique in the organization.
+Rename one of the organization’s own providers. Owner or admin. Platform providers cannot be renamed; names must be unique in the organization.
 
 ```
-ghostdock providers rename <sandbox-provider-id> --name <string> [flags]
+ghostdock provider rename <provider> --name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
+| `<provider>` | Provider id, from provider list. Required. |
 | `--name <string>` | New name, unique in the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `providers_rename`.
+MCP tool: `provider_rename`.
 
-### `ghostdock providers set-default`
+### `ghostdock provider set-default`
 
-Set the provider used when a create omits sandboxProviderId. Applies to sandboxes create, projects publish and projects redeploy. Pass an own connected provider or a platform provider that accepts new sandboxes; pass null (or platformDefaultSandboxProviderId) to follow the platform default. Owner or admin.
+Set the provider used when a create omits provider. Applies to vm create, project publish and project redeploy. Pass an own connected provider or a platform provider that accepts new VMs; pass null (or platformDefaultProviderId) to follow the platform default. Owner or admin.
 
 ```
-ghostdock providers set-default <sandbox-provider-id> [flags]
+ghostdock provider set-default <provider> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-provider-id>` | Instance id from providers list (own or platform), or null to follow the platform default. Passing platformDefaultSandboxProviderId also follows the platform default; it is never pinned. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<provider>` | Instance id from provider list (own or platform), or null to follow the platform default. Passing platformDefaultProviderId also follows the platform default; it is never pinned. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `providers_set_default`.
+MCP tool: `provider_set_default`.
 
-### `ghostdock providers start-incus`
+### `ghostdock provider start-incus`
 
-Start connecting an Incus host as a sandbox provider. Owner or admin. Returns sshPublicKey and aiSetupPrompt; then call providers verify-incus. To finish an incomplete setup, reuse it from providers list instead of starting again. Read the incus-setup skill (`ghostdock skills get incus-setup`) first.
+Start connecting an Incus host as a provider. Owner or admin. Returns sshPublicKey and aiSetupPrompt; then call provider verify-incus. To finish an incomplete setup, reuse it from provider list instead of starting again. Read the incus-setup skill (`ghostdock skill get incus-setup`) first.
 
 ```
-ghostdock providers start-incus [flags]
+ghostdock provider start-incus [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
 | `--name <string>` | Name for the new provider. Optional. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `providers_start_incus`.
+MCP tool: `provider_start_incus`.
 
-### `ghostdock providers verify-incus`
+### `ghostdock provider verify-incus`
 
-Check or finish connecting an Incus host. Owner or admin. Connects over SSH with the stored key and checks Incus 6.3+, skopeo and umoci. Omit sshHost to re-check the stored address; pass it (with the other host fields) only to move the provider. A failed check marks the provider error. Read the incus-setup skill (`ghostdock skills get incus-setup`).
+Check or finish connecting an Incus host. Owner or admin. Connects over SSH with the stored key and checks Incus 6.3+, skopeo and umoci. Omit sshHost to re-check the stored address; pass it (with the other host fields) only to move the provider. A failed check marks the provider error. Read the incus-setup skill (`ghostdock skill get incus-setup`).
 
 ```
-ghostdock providers verify-incus <sandbox-provider-id> [flags]
+ghostdock provider verify-incus <provider> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
+| `<provider>` | Provider id, from provider list. Required. |
 | `--ssh-host <string>` | Host to SSH to. Omit to re-check the stored address; pass it only to set up or move the provider. |
 | `--ssh-port <integer>` | SSH port. Default 22. |
 | `--ssh-user <string>` | SSH login. Default incus-user. |
 | `--ingress-host <string>` | Public hostname for HTTP(S) when it is not the SSH host (also the DNS A/AAAA target). |
-| `--ssh-proxy-port <integer>` | Port for sandbox SSH on the host. Default 2222. |
+| `--ssh-proxy-port <integer>` | Port for VM SSH on the host. Default 2222. |
 | `--name <string>` | New name. Optional. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `providers_verify_incus`.
+MCP tool: `provider_verify_incus`.
 
 ## `ghostdock registry`
 
@@ -715,8 +715,8 @@ ghostdock registry credentials [flags]
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
+| `--provider <value>` | Provider id. Omit for the provider `vm create` would pick (org default, else platform default, else the first that fits). |
 
 MCP tool: `registry_credentials`.
 
@@ -730,981 +730,1075 @@ ghostdock registry login [flags]
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
+| `--provider <value>` | Provider id. Omit for the provider `vm create` would pick (org default, else platform default, else the first that fits). |
 
-## `ghostdock sandboxes`
+## `ghostdock site`
 
-Create, run and manage sandboxes.
+Static sites on the CDN.
 
-### `ghostdock sandboxes build`
+### `ghostdock site publish`
 
-Create a sandbox from a local Dockerfile or Compose directory. Zips the directory (or takes --zip) and builds it on the sandbox provider; use it when the Dockerfile copies local files or the Compose project has build contexts.
+Publish a local directory or ZIP to the CDN.
 
 ```
-ghostdock sandboxes build [path] --kind <value> [flags]
+ghostdock site publish [path] [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--kind <value>` | dockerfile or compose. Required. |
-| `--sandbox-provider-id <value>` | Configured sandbox-provider instance id (omit for the organization default). |
-| `--display-name <value>` | Optional sandbox display name. |
-| `--zip <value>` | Local ZIP of the build directory (Dockerfile or compose file at the zip root). |
-| `<path>` | Build directory to zip and create from. |
-
-### `ghostdock sandboxes commands`
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
+| `--display-name <value>` | Optional site display name. |
+| `--zip <value>` | Local ZIP file to publish. |
+| `<path>` | File or directory to publish (additional paths are allowed). |
 
-Run commands in a sandbox and read their output.
+MCP tool: `site_publish`.
 
-### `ghostdock sandboxes commands get`
+### `ghostdock site unpublish`
 
-Get a shell command’s status and exit code.
+Take a published static site offline.
 
 ```
-ghostdock sandboxes commands get <command-id> --sandbox-id <string> --session-id <string> [flags]
+ghostdock site unpublish <site-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<site-id>` | Site id: the slug in the public URL, as returned by site publish or app list. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_commands_get`.
+MCP tool: `site_unpublish`.
 
-### `ghostdock sandboxes commands kill`
+## `ghostdock skill`
 
-Interrupt a running shell command.
+List and read Agent Skills (same catalog as MCP skill://index.json).
+
+### `ghostdock skill get`
+
+Print one SKILL.md (URI from the discovery index, or a skill name).
 
 ```
-ghostdock sandboxes commands kill <command-id> --sandbox-id <string> --session-id <string> [flags]
+ghostdock skill get <uri>
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<uri>` | skill:// URI, org/name, or skill name. Required. |
 
-MCP tool: `sandboxes_commands_kill`.
+MCP tool: `skill_get`.
 
-### `ghostdock sandboxes commands logs`
+### `ghostdock skill list`
 
-Get a page of a shell command’s stdout and stderr.
+List the Agent Skills discovery index.
 
 ```
-ghostdock sandboxes commands logs <command-id> --sandbox-id <string> --session-id <string> [flags]
+ghostdock skill list
 ```
 
-| Argument | Description |
-| --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--offset <integer>` | Character offset to continue reading from. Default 0. |
-| `--start` | Start the container first when it is not running, without asking. |
+MCP tool: `skill_list`.
+
+## `ghostdock snapshot`
 
-MCP tool: `sandboxes_commands_logs`.
+VM snapshots.
 
-### `ghostdock sandboxes commands run`
+### `ghostdock snapshot create`
 
-Run a shell command in a sandbox. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the sandbox when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the sandbox-boot skill (`ghostdock skills get sandbox-boot`). Never put secret values in the command; it is logged.
+Save a VM’s filesystem as a reusable organization snapshot. The VM must be stopped, unless stopAndResume. Captures its URLs and environment into a manifest (secrets as required, without values). Waits up to ~120 seconds; if still pending it returns timedOut, then poll snapshot get. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
 
 ```
-ghostdock sandboxes commands run <sandbox-id> --command <string> [flags]
+ghostdock snapshot create <vm> --name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--command <string>` | Shell command to run. Never include secret values: commands are logged. Required. |
-| `--session-id <string>` | Session from sandboxes shells create, to keep cwd and environment from earlier commands. Omit for a one-off session. |
-| `--cwd <string>` | Directory to run the command in. |
-| `--wait-seconds <number>` | Seconds to wait before returning handles to poll: 1 to 120, default 120. |
-| `--start` | Start the container first when it is not running, without asking. |
-
-MCP tool: `sandboxes_commands_run`.
-
-### `ghostdock sandboxes containers`
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--name <string>` | Snapshot name, unique in the organization. Required. |
+| `--stop-and-resume` | When the VM is running: stop it, snapshot, then start it again. Without this it must already be stopped. |
+| `--include-secret-values <array>` | Names of VM-local secrets whose values to embed in the snapshot. Organization secrets cannot be copied. (JSON array) |
+| `--manifest <object>` | Replaces the captured URLs and environment entirely (no merge). An omitted ephemeral is copied from the VM. Secret values are stored encrypted. (JSON object) |
 
-Containers of a sandbox’s Docker engine.
+MCP tool: `snapshot_create`.
 
-### `ghostdock sandboxes containers list`
+### `ghostdock snapshot delete`
 
-List the containers of a sandbox, running or not. Each with state, health, restart policy, ports, Compose project and service, deletion protection, ghostdock.* labels, and which one is the default. A stopped sandbox lists none (it is not started for this).
+Permanently delete an organization snapshot (provider artifact and record).
 
 ```
-ghostdock sandboxes containers list <sandbox-id> [flags]
+ghostdock snapshot delete <snapshot-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<snapshot-id>` | Snapshot id from snapshot list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_containers_list`.
+MCP tool: `snapshot_delete`.
 
-### `ghostdock sandboxes containers logs`
+### `ghostdock snapshot get`
 
-Read a container’s output, as docker logs does. Oldest first, each line with its stream (stdout, stderr) and time. The last tail lines (default 200), or with after only the lines after that time: pass the last line’s time to follow. truncated says lines were left out. A stopped sandbox has none (it is not started for this).
+Get one snapshot with its manifest and required environment, URLs and MCPs. Returns a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. Poll it after snapshot create while status is pending.
 
 ```
-ghostdock sandboxes containers logs <sandbox-id> <container> [flags]
+ghostdock snapshot get <snapshot-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--tail <integer>` | The last N lines (at most 5000). |
-| `--after <string>` | Only lines after this time: the time of the last line already read. |
-| `--follow` | Keep printing new lines until Ctrl-C. |
-| `--timestamps` | Put each line's time in front of it. |
+| `<snapshot-id>` | Snapshot id from snapshot list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_containers_logs`.
+MCP tool: `snapshot_get`.
 
-### `ghostdock sandboxes containers protection`
+### `ghostdock snapshot list`
 
-Switch a container’s deletion protection on or off. A protected container cannot be removed or recreated (docker rm, compose down) until its protection is off. Starts the sandbox when needed.
+List the snapshots an organization can boot VMs from. Each item has status (pending, active, error), the provider that holds it (providerId; boot it there), vmCount, and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps.
 
 ```
-ghostdock sandboxes containers protection <sandbox-id> <container> --protected <value> [flags]
+ghostdock snapshot list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--protected` | true: protect it; false: allow removing it. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_containers_protection`.
+MCP tool: `snapshot_list`.
 
-### `ghostdock sandboxes containers restart`
+### `ghostdock snapshot update-manifest`
 
-Restart a container, as docker restart does (stopping as docker stop does). Starts the sandbox when needed.
+Replace a snapshot’s manifest (URLs, environment, MCPs). Does not change the snapshot itself. Secret values in the body are stored encrypted; the response is redacted. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
 
 ```
-ghostdock sandboxes containers restart <sandbox-id> <container> [flags]
+ghostdock snapshot update-manifest <snapshot-id> --manifest <object> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<snapshot-id>` | Snapshot id from snapshot list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--manifest <object>` | The new manifest; replaces the stored one. An omitted ephemeral keeps the stored value. Secret values are stored encrypted. (JSON object) Required. |
 
-MCP tool: `sandboxes_containers_restart`.
+MCP tool: `snapshot_update_manifest`.
 
-### `ghostdock sandboxes containers start`
+## `ghostdock template`
 
-Start a stopped container, as docker start does. A running container stays as it is. Starts the sandbox when needed.
+### `ghostdock template create`
+
+Save a VM create request as a template of the organization. Its members and agents make it with `ghostdock vm up <name>`. spec is what vm create takes without the organization’s own things: source (an image ref, Dockerfile, Compose files or a Compose reference; no snapshot or catalog id) and defaults (resources, lifecycle, restart, urls, mcps). Environment values stay out: a template that needs some declares them as ghostdock.env labels. A name the platform has too is allowed: the answer says shadows true, and the organization’s template wins for its members.
 
 ```
-ghostdock sandboxes containers start <sandbox-id> <container> [flags]
+ghostdock template create --name <string> --title <string> --spec <object> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--name <string>` | Short name, unique in the organization: lower-case words joined by hyphens, e.g. postgres-pgadmin. Required. |
+| `--title <string>` | Title on the tile. Required. |
+| `--description <string>` | What it is for, in a sentence or two. |
+| `--icon <string>` | An Iconify class the app bundles (i-simple-icons-postgresql, i-lucide-database) or an https image URL. Omit for the default icon. |
+| `--spec <object>` | The create request: { source, resources?, autoStopIntervalMinutes?, lifecycle?, autoDeleteAfterDays?, restart?, urls?, mcps? }, the same fields vm create takes. (JSON object) Required. |
 
-MCP tool: `sandboxes_containers_start`.
+MCP tool: `template_create`.
 
-### `ghostdock sandboxes containers stop`
+### `ghostdock template delete`
 
-Stop a container, as docker stop does. It gets its own stop signal, then a kill after its own stop timeout. It stays stopped while the sandbox sleeps and wakes, as Docker keeps a stopped container stopped, unless its restart policy is always. On a stopped sandbox it does nothing (note sandbox_stopped). The container main runs the sandbox: its stop is refused (main_is_the_sandbox), pause the sandbox instead. Deletion protection does not block it. note says when it was the default container or the last one running: then SSH, commands and files have nowhere to land until one runs.
+Delete a template of the organization by its name. VMs made from it keep running; a platform template it shadowed answers to the name again.
 
 ```
-ghostdock sandboxes containers stop <sandbox-id> <container> [flags]
+ghostdock template delete <template> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<template>` | The organization’s template, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_containers_stop`.
+MCP tool: `template_delete`.
 
-### `ghostdock sandboxes create`
+### `ghostdock template list`
 
-Create a sandbox from a snapshot, OCI image, Dockerfile or Compose files. Inline content only: for a directory or ZIP (Dockerfile COPY/ADD, Compose build files) use `ghostdock sandboxes build`. Snapshots and catalog images can require environment entries, URL ports and MCP names (requiredEnvironment / requiredUrls / requiredMcps); a missing environment entry fails with its names (missingEnvironment), and removing a required URL or MCP fails with them (missingUrls / missingMcps). Returns once the sandbox is running, with `boot`: how long the sandbox (VM) and, when one was started, its container took to start, each in ms. Idle-stop and auto-delete apply (defaults 20 minutes / 14 days). Read the sandboxes skill (`ghostdock skills get sandboxes`) for sources, manifests, lifecycle and providers.
+List the templates to create a VM from (headless, desktop, nginx, …). The platform’s ready-made VMs and the organization’s own, each with scope (platform or organization), title, description and the create request it stands for (spec: source plus defaults such as URLs and resources). A name means the organization’s template first: one with shadows true hides the platform template of the same name (shadowed true), which vm up --platform still reaches. Create one with vm up.
 
 ```
-ghostdock sandboxes create --source <object> [flags]
+ghostdock template list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | Display name for the sandbox. Optional. |
-| `--source <object>` | What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images list / images get — images add OCI bookmarks, images add-dockerfile, and images add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. "compose" also takes a published Compose project instead of files ({ reference: "oci://…", override? }): it runs through include:, the override merged into it. Image, dockerfile, and compose sources never appear in snapshots list. Published static sites use sites publish (CDN), not a snapshot. (JSON object) Required. |
-| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
-| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the platform worker deletes the record. 0 deletes it when it stops. -1 keeps it until a person deletes it. Omit for the platform default. Provider-native timers are optional backup. |
-| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
-| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
-| `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
-| `--image-base <string>` | How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty. |
-| `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
-| `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_create`.
+MCP tool: `template_list`.
 
-### `ghostdock sandboxes default-container`
+### `ghostdock template update`
 
-Show, set or clear the sandbox’s default container. SSH, the terminal, files, commands and MCP land there when no container is named. Without container or clear it only shows the setting.
+Change a template of the organization by its name. The fields given replace the stored ones (a spec replaces the whole spec). Platform templates are changed by platform admins only.
 
 ```
-ghostdock sandboxes default-container <sandbox-id> [flags]
+ghostdock template update <template> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to make the default, by name. The running sandbox must have it. |
-| `--clear` | Clear the default. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<template>` | The organization’s template, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--name <string>` | A new name; vm up answers to it only. |
+| `--title <string>` | Title on the tile. |
+| `--description <string>` | What it is for. |
+| `--icon <string>` | Iconify class or https image URL; null for the default icon. |
+| `--spec <object>` | The whole create request, as template create takes it. (JSON object) |
+
+MCP tool: `template_update`.
+
+## `ghostdock tools`
 
-MCP tool: `sandboxes_default_container`.
+List available agent tools.
+
+```
+ghostdock tools
+```
+
+## `ghostdock vm`
+
+Create, run and manage VMs.
 
-### `ghostdock sandboxes delete`
+### `ghostdock vm build`
 
-Permanently delete a sandbox and its files.
+Create a VM from a local Dockerfile or Compose directory. Zips the directory (or takes --zip) and builds it on the provider; use it when the Dockerfile copies local files or the Compose project has build contexts.
 
 ```
-ghostdock sandboxes delete <sandbox-id> [flags]
+ghostdock vm build [path] --kind <value> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-
-MCP tool: `sandboxes_delete`.
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
+| `--kind <value>` | dockerfile or compose. Required. |
+| `--provider <value>` | Configured provider instance id (omit for the organization default). |
+| `--display-name <value>` | Optional VM display name. |
+| `--zip <value>` | Local ZIP of the build directory (Dockerfile or compose file at the zip root). |
+| `<path>` | Build directory to zip and create from. |
 
-### `ghostdock sandboxes env`
+### `ghostdock vm command`
 
-Environment of one sandbox.
+Run commands in a VM and read their output.
 
-### `ghostdock sandboxes env delete`
+### `ghostdock vm command get`
 
-Delete one of a sandbox’s own variables or secrets.
+Get a shell command’s status and exit code.
 
 ```
-ghostdock sandboxes env delete <name> --sandbox-id <string> [flags]
+ghostdock vm command get <command-id> --vm <string> --session-id <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
+| `<command-id>` | Command id returned by vm command run. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--session-id <string>` | Session id returned by vm command run together with the commandId. Required. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_env_delete`.
+MCP tool: `vm_command_get`.
 
-### `ghostdock sandboxes env get`
+### `ghostdock vm command kill`
 
-Get a sandbox’s environment: selections, bindings and local entries. Shows each organization entry with whether it is selected, exportAs, and overriddenByLocal; secret values are withheld. Nothing is inherited.
+Interrupt a running shell command.
 
 ```
-ghostdock sandboxes env get <sandbox-id> [flags]
+ghostdock vm command kill <command-id> --vm <string> --session-id <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<command-id>` | Command id returned by vm command run. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--session-id <string>` | Session id returned by vm command run together with the commandId. Required. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_env_get`.
+MCP tool: `vm_command_kill`.
 
-### `ghostdock sandboxes env select`
+### `ghostdock vm command logs`
 
-Replace the organization entries a sandbox exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Running processes keep their old values until restarted (pass restart). Read the environment skill (`ghostdock skills get environment`).
+Get a page of a shell command’s stdout and stderr.
 
 ```
-ghostdock sandboxes env select <sandbox-id> --environment <array> [flags]
+ghostdock vm command logs <command-id> --vm <string> --session-id <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--environment <array>` | Organization catalogue entry names to export under their own names. Pass [] to clear plain selections. (JSON array) Required. |
-| `--bindings <array>` | Slot-centric org bindings: export an organization entry under a (possibly different) sandbox env name. Omit to clear existing remaps (full replace). (JSON array) |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only; already-running processes keep the old values until restarted. |
+| `<command-id>` | Command id returned by vm command run. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--session-id <string>` | Session id returned by vm command run together with the commandId. Required. |
+| `--offset <integer>` | Character offset to continue reading from. Default 0. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_env_select`.
+MCP tool: `vm_command_logs`.
 
-### `ghostdock sandboxes env set`
+### `ghostdock vm command run`
 
-Create or replace one of a sandbox’s own variables or secrets. It overrides an organization entry of the same name. kind is required when creating. Setting secrets via this tool is allowed; prefer the Ghostdock CLI so values stay out of the conversation, and never put them in commands.
+Run a shell command in a VM. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the VM when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the vm-boot skill (`ghostdock skill get vm-boot`). Never put secret values in the command; it is logged.
 
 ```
-ghostdock sandboxes env set <name> --sandbox-id <string> --value <string> [flags]
+ghostdock vm command run <vm> --command <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
-| `--kind <string>` | Required when creating. Use "secret" for credentials; secret values can be replaced but never read back. Omit when updating to keep the existing kind. |
-| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--command <string>` | Shell command to run. Never include secret values: commands are logged. Required. |
+| `--session-id <string>` | Session from vm shell create, to keep cwd and environment from earlier commands. Omit for a one-off session. |
+| `--cwd <string>` | Directory to run the command in. |
+| `--wait-seconds <number>` | Seconds to wait before returning handles to poll: 1 to 120, default 120. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_env_set`.
+MCP tool: `vm_command_run`.
 
-### `ghostdock sandboxes files`
+### `ghostdock vm container`
 
-Files inside a sandbox.
+Containers of a VM’s Docker engine.
 
-### `ghostdock sandboxes files list`
+### `ghostdock vm container list`
 
-List the files in a sandbox directory (default /workspace).
+List the containers of a VM, running or not. Each with state, health, restart policy, ports, Compose project and service, its lock (locked, and whether a person or its ghostdock.lock label decided), ghostdock.* labels, and which one is the default. A stopped VM lists none (it is not started for this).
 
 ```
-ghostdock sandboxes files list <sandbox-id> [flags]
+ghostdock vm container list <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--path <string>` | Directory to list. Absolute or relative to /. Defaults to /workspace. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_files_list`.
+MCP tool: `vm_container_list`.
 
-### `ghostdock sandboxes files read`
+### `ghostdock vm container lock`
 
-Read a file from a sandbox: utf8 text, or base64 for small binaries.
+Lock a container against removal. A locked container cannot be removed, renamed or recreated through Docker (docker rm, compose down, a compose up that would recreate it) until it is unlocked here; start, stop and restart still work. It also pauses the VM’s auto-delete. An ephemeral VM’s stop still wipes it. Never starts the VM: a stopped one gets the lock at its next start.
 
 ```
-ghostdock sandboxes files read <path> --sandbox-id <string> [flags]
+ghostdock vm container lock <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<path>` | File path. Absolute or relative to / (for example /workspace/src/App.vue). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_files_read`.
+MCP tool: `vm_container_lock`.
 
-### `ghostdock sandboxes files upload`
+### `ghostdock vm container logs`
 
-Upload local files or directories to a sandbox using multipart form data.
+Read a container’s output, as docker logs does. Oldest first, each line with its stream (stdout, stderr) and time. The last tail lines (default 200), or with after only the lines after that time: pass the last line’s time to follow. truncated says lines were left out. A stopped VM has none (it is not started for this).
 
 ```
-ghostdock sandboxes files upload <sandbox-id> [path] [flags]
+ghostdock vm container logs <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name or id. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--container <value>` | Container the files land in, by name, from `ghostdock sandboxes containers list`. Default: the sandbox's default container, else the one running container. |
-| `--start` | Start the container first when it is not running, without asking. |
-| `--zip <value>` | Local ZIP file to upload. |
-| `<path>` | File or directory to upload (additional paths are allowed). |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--tail <integer>` | The last N lines (at most 5000). |
+| `--after <string>` | Only lines after this time: the time of the last line already read. |
+| `--follow` | Keep printing new lines until Ctrl-C. |
+| `--timestamps` | Put each line's time in front of it. |
 
-MCP tool: `sandboxes_files_upload`.
+MCP tool: `vm_container_logs`.
 
-### `ghostdock sandboxes list`
+### `ghostdock vm container restart`
 
-List the sandboxes of an organization, including whether each is ephemeral. Each has a name (e.g. quiet-harbor), unique in the organization, that every sandbox tool accepts as sandboxId.
+Restart a container, as docker restart does (stopping as docker stop does). Starts the VM when needed.
 
 ```
-ghostdock sandboxes list [flags]
+ghostdock vm container restart <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-
-MCP tool: `sandboxes_list`.
-
-### `ghostdock sandboxes mcps`
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP endpoints a sandbox exposes.
+MCP tool: `vm_container_restart`.
 
-### `ghostdock sandboxes mcps create`
+### `ghostdock vm container start`
 
-Expose an MCP server running in a sandbox. Idempotent by name.
+Start a stopped container, as docker start does. A running container stays as it is. Starts the VM when needed.
 
 ```
-ghostdock sandboxes mcps create <sandbox-id> --name <string> --port <integer> [flags]
+ghostdock vm container start <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Endpoint name, unique in the sandbox. Letters, digits, _ and -, starting with a letter. Required. |
-| `--port <integer>` | Port the MCP server listens on inside the sandbox. Required. |
-| `--path <string>` | HTTP path of the MCP endpoint. Default /mcp. |
-| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Default false. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_mcps_create`.
+MCP tool: `vm_container_start`.
 
-### `ghostdock sandboxes mcps delete`
+### `ghostdock vm container stop`
 
-Delete an MCP endpoint of a sandbox.
+Stop a container, as docker stop does. It gets its own stop signal, then a kill after its own stop timeout. It stays stopped while the VM sleeps and wakes, as Docker keeps a stopped container stopped, unless its restart policy is always. On a stopped VM it does nothing (note vm_stopped). A lock does not block it. note says when it was the default container or the last one running: then SSH, commands and files have nowhere to land until one runs.
 
 ```
-ghostdock sandboxes mcps delete <mcp-id>
+ghostdock vm container stop <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_mcps_delete`.
+MCP tool: `vm_container_stop`.
 
-### `ghostdock sandboxes mcps list`
+### `ghostdock vm container unlock`
 
-List the MCP endpoints a sandbox exposes (name, port, path, autoWake).
+Unlock a container so Docker can remove or recreate it. Also one its image locked with the ghostdock.lock label. Never starts the VM: a stopped one gets it at its next start, and an overdue auto-delete it held goes ahead.
 
 ```
-ghostdock sandboxes mcps list <sandbox-id> [flags]
+ghostdock vm container unlock <vm> <container> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_mcps_list`.
+MCP tool: `vm_container_unlock`.
 
-### `ghostdock sandboxes mcps update`
+### `ghostdock vm create`
 
-Change an MCP endpoint’s name, port, path or autoWake setting.
+Create a VM from a snapshot, OCI image, Dockerfile or Compose files. Inline content only: for a directory or ZIP (Dockerfile COPY/ADD, Compose build files) use `ghostdock vm build`. Snapshots and catalog images can require environment entries, URL ports and MCP names (requiredEnvironment / requiredUrls / requiredMcps); a missing environment entry fails with its names (missingEnvironment), and removing a required URL or MCP fails with them (missingUrls / missingMcps). Every source but a snapshot becomes a Compose project in the VM, run once with docker compose up -d; after that Docker is the truth. Returns once the project is up, with `boot`: how long the VM and the project's compose up took, each in ms, and the images it pulled. Idle-stop and auto-delete apply (defaults 20 minutes / 14 days). Read the vm skill (`ghostdock skill get vm`) for sources, manifests, lifecycle and providers.
 
 ```
-ghostdock sandboxes mcps update <mcp-id> [flags]
+ghostdock vm create --source <object> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
-| `--name <string>` | New endpoint name. Omit to keep it. |
-| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
-| `--path <string>` | New HTTP path. Omit to keep it. |
-| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Omit to keep it. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--display-name <string>` | Display name for the VM. Optional. |
+| `--source <object>` | What the VM boots from. Required. "template" boots a template by its name ({ name, scope? } from template list, e.g. headless, desktop, nginx): the organization’s of that name, else the platform’s (scope picks one), its source and defaults, under every other field of this call (a URL on the same port or an MCP of the same name replaces the template's; vm up is the short form). "image" boots an org catalog row by id ({ id } from image list / image get — image add OCI bookmarks, image add-dockerfile, and image add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock vm build --kind dockerfile` with a directory or ZIP); "compose" runs the given inline files with docker compose up -d (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). Every source but a snapshot becomes a Compose project in /srv/ghostdock/<vm name>, run once; an image is one service named after it, a Dockerfile the service app. A Compose project that needs extra files is not accepted here — use `ghostdock vm build --kind compose`. "compose" also takes a published Compose project instead of files ({ reference: "oci://…", override? }): it runs through include:, the override merged into it. Image, dockerfile, and compose sources never appear in snapshot list. Published static sites use site publish (CDN), not a snapshot. (JSON object) Required. |
+| `--restart <string>` | Restart policy of the service an image or a Dockerfile becomes, Docker's names: unless-stopped (default), always, on-failure, or no (it does not come back after the VM sleeps). Not for Compose: its files set restart:. |
+| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the VM. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
+| `--lifecycle <string>` | What may make the VM disappear on its own. ephemeral: every stop wipes the VM and its disk, and the next start runs its Compose project again (edits in the project folder kept, everything else gone; locks too). auto_delete (default): a stop keeps the disk, and the record goes autoDeleteAfterDays after the stop. keep: never removed automatically. Omit for the image label ghostdock.ephemeral, else auto_delete. ephemeral is chosen here only. |
+| `--auto-delete-after-days <integer>` | Days the VM stays stopped before the platform worker deletes the record (0–365; 0 deletes it when it stops). Omit for the platform default (14). Not with keep. A container a person locked holds it. |
+| `--provider <string>` | Provider id from provider list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new VMs and has it is used. When no provider fits, the call fails with a not-configured error. |
+| `--environment <object>` | Environment to give this VM. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: VM-only variables/secrets to create with the VM (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a VM gets nothing unless listed here. (JSON object) |
+| `--image-base <string>` | How the disk is made for one of Ghostdock's platform images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty. |
+| `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
+| `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
 
-MCP tool: `sandboxes_mcps_update`.
+MCP tool: `vm_create`.
 
-### `ghostdock sandboxes resize`
+### `ghostdock vm default-container`
 
-Change a sandbox’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: sandboxes resize-disk.
+Show, set or clear the VM’s default container. SSH, the terminal, files, commands and MCP land there when no container is named. Without container or clear it only shows the setting.
 
 ```
-ghostdock sandboxes resize <sandbox-id> [flags]
+ghostdock vm default-container <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--cpu <number>` | Number of CPUs. |
-| `--memory-gib <number>` | Memory in GiB. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--container <string>` | Container to make the default, by name. The running VM must have it. |
+| `--clear` | Clear the default. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_resize`.
+MCP tool: `vm_default_container`.
 
-### `ghostdock sandboxes resize-disk`
+### `ghostdock vm delete`
 
-Grow a sandbox’s disk. The sandbox must be stopped first (this tool does not stop it). Disk only grows, never shrinks.
+Permanently delete a VM and its files. Refused while it has locked containers (vm_has_locked_containers, naming them) unless deleteLocked is true.
 
 ```
-ghostdock sandboxes resize-disk <sandbox-id> --disk-gib <number> [flags]
+ghostdock vm delete <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--disk-gib <number>` | New total disk size in GiB; must be larger than the current size. Required. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--delete-locked` | Delete it with its locked containers. Without it, a locked container refuses the delete. |
+
+MCP tool: `vm_delete`.
 
-MCP tool: `sandboxes_resize_disk`.
+### `ghostdock vm env`
 
-### `ghostdock sandboxes set-boot`
+Environment of one VM.
 
-Register a command that starts now and again after every restart. For example bun dev. On Compose it runs after the stack; on a Dockerfile it replaces the image CMD. Snapshots cannot register one. Read the sandbox-boot skill (`ghostdock skills get sandbox-boot`).
+### `ghostdock vm env delete`
+
+Delete one of a VM’s own variables or secrets.
 
 ```
-ghostdock sandboxes set-boot <sandbox-id> --command <string> [flags]
+ghostdock vm env delete <name> --vm <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--command <string>` | Command to start, e.g. bun dev. Required. |
-| `--cwd <string>` | Directory to run it in. Default /. |
-| `--start` | Also start it now, not only after restarts. Default true. |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--restart` | When true and the VM is running, stop then start after saving so processes pick up the change. Default: sync only. |
 
-MCP tool: `sandboxes_set_boot`.
+MCP tool: `vm_env_delete`.
 
-### `ghostdock sandboxes shells`
+### `ghostdock vm env get`
 
-Shell sessions that keep cwd and environment between commands.
+Get a VM’s environment: selections, bindings and local entries. Shows each organization entry with whether it is selected, exportAs, and overriddenByLocal; secret values are withheld. Nothing is inherited.
 
-### `ghostdock sandboxes shells close`
+```
+ghostdock vm env get <vm> [flags]
+```
 
-Close a shell session.
+| Argument | Description |
+| --- | --- |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+
+MCP tool: `vm_env_get`.
+
+### `ghostdock vm env select`
+
+Replace the organization entries a VM exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Running processes keep their old values until restarted (pass restart). Read the environment skill (`ghostdock skill get environment`).
 
 ```
-ghostdock sandboxes shells close <session-id> --sandbox-id <string> [flags]
+ghostdock vm env select <vm> --environment <array> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<session-id>` | Session id from sandboxes shells create. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--environment <array>` | Organization catalogue entry names to export under their own names. Pass [] to clear plain selections. (JSON array) Required. |
+| `--bindings <array>` | Slot-centric org bindings: export an organization entry under a (possibly different) VM env name. Omit to clear existing remaps (full replace). (JSON array) |
+| `--restart` | When true and the VM is running, stop then start after saving so processes pick up the change. Default: sync only; already-running processes keep the old values until restarted. |
 
-MCP tool: `sandboxes_shells_close`.
+MCP tool: `vm_env_select`.
 
-### `ghostdock sandboxes shells create`
+### `ghostdock vm env set`
 
-Open a shell session that keeps cwd and environment between commands. Starts the sandbox when allowed; the session ends at idle-stop.
+Create or replace one of a VM’s own variables or secrets. It overrides an organization entry of the same name. kind is required when creating. Setting secrets via this tool is allowed; prefer the Ghostdock CLI so values stay out of the conversation, and never put them in commands.
 
 ```
-ghostdock sandboxes shells create <sandbox-id> [flags]
+ghostdock vm env set <name> --vm <string> --value <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Id for the new session: a slug; user-cmd, image-cmd and compose are reserved. Omit to generate one. |
-| `--start` | Start the container first when it is not running, without asking. |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
+| `--kind <string>` | Required when creating. Use "secret" for credentials; secret values can be replaced but never read back. Omit when updating to keep the existing kind. |
+| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
+| `--restart` | When true and the VM is running, stop then start after saving so processes pick up the change. Default: sync only. |
 
-MCP tool: `sandboxes_shells_create`.
+MCP tool: `vm_env_set`.
 
-### `ghostdock sandboxes ssh`
+### `ghostdock vm file`
 
-SSH access to a sandbox.
+Files inside a VM.
 
-### `ghostdock sandboxes ssh get`
+### `ghostdock vm file list`
 
-Get temporary SSH access to a sandbox (command and token, 60 minutes). Starts the sandbox when needed. Idle-stop still applies, independent of the token.
+List the files in a VM directory. Default: the container's start folder (its dir).
 
 ```
-ghostdock sandboxes ssh get <sandbox-id> [flags]
+ghostdock vm file list <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--path <string>` | Directory to list: absolute, or relative to the container's start folder (its dir: the login user's home, else WORKDIR, else /). Defaults to that folder. |
 | `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_ssh_get`.
+MCP tool: `vm_file_list`.
 
-### `ghostdock sandboxes ssh revoke`
+### `ghostdock vm file read`
 
-Revoke a sandbox’s active SSH access.
+Read a file from a VM: utf8 text, or base64 for small binaries.
 
 ```
-ghostdock sandboxes ssh revoke <sandbox-id> [flags]
+ghostdock vm file read <path> --vm <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<path>` | File path: absolute, or relative to the container's start folder (for example src/App.vue). Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_ssh_revoke`.
+MCP tool: `vm_file_read`.
 
-### `ghostdock sandboxes status`
+### `ghostdock vm file upload`
 
-Get a sandbox’s status and lifecycle deadlines without waking it. Returns idleStopsAt, deletesAt and `boot` (the last start: sandbox and container times in ms) and does not reset idle activity.
+Upload local files or directories to a VM's container, into its start folder (the login user's home, else WORKDIR, else /).
 
 ```
-ghostdock sandboxes status <sandbox-id> [flags]
+ghostdock vm file upload <vm> [path] [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name or id. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organization list` (default: GHOSTDOCK_ORG, then `ghostdock organization use`). |
+| `--container <value>` | Container the files land in, by name, from `ghostdock vm container list`. Default: the VM's default container, else the one running container. |
+| `--start` | Start the container first when it is not running, without asking. |
+| `--zip <value>` | Local ZIP file to upload. |
+| `<path>` | File or directory to upload (additional paths are allowed). |
 
-MCP tool: `sandboxes_status`.
+MCP tool: `vm_file_upload`.
 
-### `ghostdock sandboxes stop`
+### `ghostdock vm list`
 
-Stop a running sandbox without deleting its files.
+List the VMs of an organization, with their lifecycle and deadlines. Each has a name (e.g. quiet-harbor), unique in the organization, that every VM tool accepts as `vm`.
 
 ```
-ghostdock sandboxes stop <sandbox-id> [flags]
+ghostdock vm list [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+
+MCP tool: `vm_list`.
 
-MCP tool: `sandboxes_stop`.
+### `ghostdock vm mcp`
 
-### `ghostdock sandboxes storage`
+MCP endpoints a VM exposes.
 
-### `ghostdock sandboxes storage delete`
+### `ghostdock vm mcp create`
 
-Delete a named volume or a top-level sandbox folder, with everything in it. Refused while a container mounts it (in any state: a stopped one counts, so stopping does not help), mounts a folder above it (a bind of /), or a volume keeps its data in the folder: remove those first.
+Expose an MCP server running in a VM. Idempotent by name.
 
 ```
-ghostdock sandboxes storage delete <sandbox-id> --kind <string> --name <string> [flags]
+ghostdock vm mcp create <vm> --name <string> --port <integer> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--kind <string>` | volume or folder. Required. |
-| `--name <string>` | The volume’s name, or the folder’s path in the sandbox (/srv, not /srv/app). Required. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--name <string>` | Endpoint name, unique in the VM. Letters, digits, _ and -, starting with a letter. Required. |
+| `--port <integer>` | Port the MCP server listens on inside the VM. Required. |
+| `--path <string>` | HTTP path of the MCP endpoint. Default /mcp. |
+| `--auto-wake` | Start the VM when the endpoint is called while it is stopped. Default false. |
 
-MCP tool: `sandboxes_storage_delete`.
+MCP tool: `vm_mcp_create`.
 
-### `ghostdock sandboxes storage list`
+### `ghostdock vm mcp delete`
 
-List a sandbox’s volumes and sandbox folders. The sandbox folders are where bind mounts land. Each with its size and sizeState (measured; measuring: ask again in a few seconds; tooBig: too big to measure cheaply; outside: a volume bound outside the sandbox folders, not measured nor browsable) and the containers using it, plus every container’s mounts. truncated says entries were left out. A stopped sandbox lists none (it is not started for this).
+Delete an MCP endpoint of a VM.
 
 ```
-ghostdock sandboxes storage list <sandbox-id> [flags]
+ghostdock vm mcp delete <mcp-id>
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<mcp-id>` | MCP endpoint id, from vm mcp list or vm mcp create. Required. |
+
+MCP tool: `vm_mcp_delete`.
+
+### `ghostdock vm mcp list`
 
-MCP tool: `sandboxes_storage_list`.
+List the MCP endpoints a VM exposes (name, port, path, autoWake).
+
+```
+ghostdock vm mcp list <vm> [flags]
+```
 
-### `ghostdock sandboxes tools`
+| Argument | Description |
+| --- | --- |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-Tools of the MCP servers inside a sandbox.
+MCP tool: `vm_mcp_list`.
 
-### `ghostdock sandboxes tools call`
+### `ghostdock vm mcp update`
 
-Call a tool on an MCP server inside a sandbox. Wakes a stopped sandbox when the endpoint has autoWake.
+Change an MCP endpoint’s name, port, path or autoWake setting.
 
 ```
-ghostdock sandboxes tools call <name> --sandbox-id <string> --arguments <object> [flags]
+ghostdock vm mcp update <mcp-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<name>` | Tool name, from sandboxes tools list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--arguments <object>` | Tool arguments as a JSON object. (JSON object) Required. |
-| `--mcp-name <string>` | MCP endpoint to call. Needed when several endpoints expose the same tool name. |
+| `<mcp-id>` | MCP endpoint id, from vm mcp list or vm mcp create. Required. |
+| `--name <string>` | New endpoint name. Omit to keep it. |
+| `--port <integer>` | New port inside the VM. Omit to keep it. |
+| `--path <string>` | New HTTP path. Omit to keep it. |
+| `--auto-wake` | Start the VM when the endpoint is called while it is stopped. Omit to keep it. |
 
-MCP tool: `sandboxes_tools_call`.
+MCP tool: `vm_mcp_update`.
 
-### `ghostdock sandboxes tools list`
+### `ghostdock vm resize`
 
-List the tools of the MCP servers a sandbox exposes. A server that cannot be reached is reported in errors; the others are still listed.
+Change a VM’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: vm resize-disk.
 
 ```
-ghostdock sandboxes tools list <sandbox-id> [flags]
+ghostdock vm resize <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--mcp-name <string>` | Only list the tools of this MCP endpoint. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--cpu <number>` | Number of CPUs. |
+| `--memory-gib <number>` | Memory in GiB. |
 
-MCP tool: `sandboxes_tools_list`.
+MCP tool: `vm_resize`.
 
-### `ghostdock sandboxes update`
+### `ghostdock vm resize-disk`
 
-Change a sandbox’s display name, idle-stop or auto-delete interval. Omit a field to keep it; null resets it to the platform default.
+Grow a VM’s disk. The VM must be stopped first (this tool does not stop it). Disk only grows, never shrinks.
 
 ```
-ghostdock sandboxes update <sandbox-id> [flags]
+ghostdock vm resize-disk <vm> --disk-gib <number> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | New display name. Null clears it; omit to keep it. |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup. |
-| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the record is deleted. 0 deletes it when it stops. -1 keeps it. Null resets to the platform default. Provider-native timers are optional backup. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--disk-gib <number>` | New total disk size in GiB; must be larger than the current size. Required. |
 
-MCP tool: `sandboxes_update`.
+MCP tool: `vm_resize_disk`.
 
-### `ghostdock sandboxes urls`
+### `ghostdock vm shell`
 
-URLs that expose sandbox ports.
+Shell sessions that keep cwd and environment between commands.
 
-### `ghostdock sandboxes urls create`
+### `ghostdock vm shell close`
 
-Expose a sandbox port as a URL. Idempotent by port: when the sandbox already has a URL on that port, it is returned unchanged (autoWake, public and title are not applied); use sandboxes urls update to change it. HTTP defaults to private with no wake-on-visit; TCP URLs use TLS (not HTTP) and are always public — for a private port use sandboxes ssh get and an SSH forward. Read the sandboxes skill (`ghostdock skills get sandboxes`) for TCP clients.
+Close a shell session.
 
 ```
-ghostdock sandboxes urls create <sandbox-id> --port <integer> [flags]
+ghostdock vm shell close <session-id> --vm <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--port <integer>` | Port inside the sandbox to expose. Required. |
-| `--protocol <string>` | "http" (default) or "tcp". TCP URLs use TLS and are always public. |
-| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Default false. |
-| `--public` | Reachable without signing in. Default false; TCP URLs are always public. |
-| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". |
+| `<session-id>` | Session id from vm shell create. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_urls_create`.
+MCP tool: `vm_shell_close`.
 
-### `ghostdock sandboxes urls delete`
+### `ghostdock vm shell create`
 
-Delete a sandbox URL.
+Open a shell session that keeps cwd and environment between commands. Starts the VM when allowed; the session ends at idle-stop.
 
 ```
-ghostdock sandboxes urls delete <url-id>
+ghostdock vm shell create <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--session-id <string>` | Id for the new session: a slug. Omit to generate one. |
+| `--start` | Start the container first when it is not running, without asking. |
+
+MCP tool: `vm_shell_create`.
+
+### `ghostdock vm ssh`
 
-MCP tool: `sandboxes_urls_delete`.
+SSH access to a VM.
 
-### `ghostdock sandboxes urls list`
+### `ghostdock vm ssh get`
 
-List the URLs that expose a sandbox’s ports, with protocol, access and title. A titled URL (for example `Desktop`, the desktop image’s desktop in a browser) gets its own button in the app.
+Get temporary SSH access to a VM (command and token, 60 minutes). Starts the VM when needed. Idle-stop still applies, independent of the token.
 
 ```
-ghostdock sandboxes urls list <sandbox-id> [flags]
+ghostdock vm ssh get <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--container <string>` | Container to work in, by name, from vm container list. Default: the VM’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
-MCP tool: `sandboxes_urls_list`.
+MCP tool: `vm_ssh_get`.
 
-### `ghostdock sandboxes urls update`
+### `ghostdock vm ssh revoke`
 
-Change a sandbox URL’s port, protocol, autoWake, public setting or title. TCP cannot be private.
+Revoke a VM’s active SSH access.
 
 ```
-ghostdock sandboxes urls update <url-id> [flags]
+ghostdock vm ssh revoke <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
-| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
-| `--protocol <string>` | "http" or "tcp". Omit to keep the current protocol. |
-| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Omit to keep it. |
-| `--public` | Reachable without signing in. Omit to keep it; TCP cannot be made private. |
-| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". Omit to keep it; null removes it. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_urls_update`.
+MCP tool: `vm_ssh_revoke`.
 
-### `ghostdock sandboxes wake`
+### `ghostdock vm status`
 
-Start a stopped sandbox, or reset the idle-stop countdown of a running one. Returns status, idleStopsAt / deletesAt, and `boot` (sandbox and container start times in ms; null when it was already running).
+Get a VM’s status and lifecycle deadlines without waking it. Returns idleStopsAt, deletesAt and `boot` (the last start: VM and container times in ms) and does not reset idle activity.
 
 ```
-ghostdock sandboxes wake <sandbox-id> [flags]
+ghostdock vm status <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sandboxes_wake`.
+MCP tool: `vm_status`.
 
-## `ghostdock sites`
+### `ghostdock vm stop`
 
-Static sites on the CDN.
+Stop a running VM without deleting its files.
 
-### `ghostdock sites publish`
+```
+ghostdock vm stop <vm> [flags]
+```
 
-Publish a local directory or ZIP to the CDN.
+| Argument | Description |
+| --- | --- |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+
+MCP tool: `vm_stop`.
+
+### `ghostdock vm storage`
+
+### `ghostdock vm storage delete`
+
+Delete a named volume or a top-level VM folder, with everything in it. Refused while a container mounts it (in any state: a stopped one counts, so stopping does not help), mounts a folder above it (a bind of /), or a volume keeps its data in the folder: remove those first.
 
 ```
-ghostdock sites publish [path] [flags]
+ghostdock vm storage delete <vm> --kind <string> --name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--display-name <value>` | Optional site display name. |
-| `--zip <value>` | Local ZIP file to publish. |
-| `<path>` | File or directory to publish (additional paths are allowed). |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--kind <string>` | volume or folder. Required. |
+| `--name <string>` | The volume’s name, or the folder’s path in the VM (/srv, not /srv/app). Required. |
 
-MCP tool: `sites_publish`.
+MCP tool: `vm_storage_delete`.
 
-### `ghostdock sites unpublish`
+### `ghostdock vm storage list`
 
-Take a published static site offline.
+List a VM’s volumes and VM folders. The VM folders are where bind mounts land. Each with its size and sizeState (measured; measuring: ask again in a few seconds; tooBig: too big to measure cheaply; outside: a volume bound outside the VM folders, not measured nor browsable) and the containers using it, plus every container’s mounts. truncated says entries were left out. A stopped VM lists none (it is not started for this).
 
 ```
-ghostdock sites unpublish <site-id> [flags]
+ghostdock vm storage list <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<site-id>` | Site id: the slug in the public URL, as returned by sites publish or apps list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `sites_unpublish`.
+MCP tool: `vm_storage_list`.
 
-## `ghostdock skills`
+### `ghostdock vm tool`
 
-List and read Agent Skills (same catalog as MCP skill://index.json).
+Tools of the MCP servers inside a VM.
 
-### `ghostdock skills get`
+### `ghostdock vm tool call`
 
-Print one SKILL.md (URI from the discovery index, or a skill name).
+Call a tool on an MCP server inside a VM. Wakes a stopped VM when the endpoint has autoWake.
 
 ```
-ghostdock skills get <uri>
+ghostdock vm tool call <name> --vm <string> --arguments <object> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<uri>` | skill:// URI, org/name, or skill name. Required. |
+| `<name>` | Tool name, from vm tool list. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--vm <string>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--arguments <object>` | Tool arguments as a JSON object. (JSON object) Required. |
+| `--mcp-name <string>` | MCP endpoint to call. Needed when several endpoints expose the same tool name. |
 
-MCP tool: `skills_get`.
+MCP tool: `vm_tool_call`.
 
-### `ghostdock skills list`
+### `ghostdock vm tool list`
 
-List the Agent Skills discovery index.
+List the tools of the MCP servers a VM exposes. A server that cannot be reached is reported in errors; the others are still listed.
 
 ```
-ghostdock skills list
+ghostdock vm tool list <vm> [flags]
 ```
 
-MCP tool: `skills_list`.
+| Argument | Description |
+| --- | --- |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--mcp-name <string>` | Only list the tools of this MCP endpoint. |
+
+MCP tool: `vm_tool_list`.
+
+### `ghostdock vm up`
 
-## `ghostdock snapshots`
+Create a VM from a template by its name: `ghostdock vm up nginx`. The organization’s template of that name, else the platform’s (template list); platform true takes the platform’s. The same as vm create with source { type: "template", name }: the template's source and defaults, under the fields given here. Returns like vm create, with the template it used.
+
+```
+ghostdock vm up <template> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<template>` | Template name from template list, e.g. headless. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--platform` | Take the platform’s template of this name even when the organization has its own (shadows). |
+| `--display-name <string>` | Display name for the VM. Optional. |
+| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the VM. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
+| `--lifecycle <string>` | What may make the VM disappear on its own. ephemeral: every stop wipes the VM and its disk, and the next start runs its Compose project again (edits in the project folder kept, everything else gone; locks too). auto_delete (default): a stop keeps the disk, and the record goes autoDeleteAfterDays after the stop. keep: never removed automatically. Omit for the image label ghostdock.ephemeral, else auto_delete. ephemeral is chosen here only. |
+| `--auto-delete-after-days <integer>` | Days the VM stays stopped before the platform worker deletes the record (0–365; 0 deletes it when it stops). Omit for the platform default (14). Not with keep. A container a person locked holds it. |
+| `--provider <string>` | Provider id from provider list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new VMs and has it is used. When no provider fits, the call fails with a not-configured error. |
+| `--environment <object>` | Environment to give this VM. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: VM-only variables/secrets to create with the VM (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a VM gets nothing unless listed here. (JSON object) |
+| `--urls <array>` | Changes to the template’s and its image’s URLs, keyed by port, as in vm create: the same port replaces, { port, remove: true } drops. (JSON array) |
 
-Sandbox snapshots.
+MCP tool: `vm_up`.
 
-### `ghostdock snapshots create`
+### `ghostdock vm update`
 
-Save a sandbox’s filesystem as a reusable organization snapshot. The sandbox must be stopped, unless stopAndResume. Captures its URLs and environment into a manifest (secrets as required, without values). Waits up to ~120 seconds; if still pending it returns timedOut, then poll snapshots get. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
+Change a VM’s display name, idle-stop interval or lifecycle. Omit a field to keep it; null resets it to the platform default. Ephemeral is chosen at create only.
 
 ```
-ghostdock snapshots create <sandbox-id> --name <string> [flags]
+ghostdock vm update <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Snapshot name, unique in the organization. Required. |
-| `--stop-and-resume` | When the sandbox is running: stop it, snapshot, then start it again. Without this it must already be stopped. |
-| `--include-secret-values <array>` | Names of sandbox-local secrets whose values to embed in the snapshot. Organization secrets cannot be copied. (JSON array) |
-| `--manifest <object>` | Replaces the captured URLs and environment entirely (no merge). An omitted ephemeral is copied from the sandbox. Secret values are stored encrypted. (JSON object) |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--display-name <string>` | New display name. Null clears it; omit to keep it. |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the VM. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup. |
+| `--lifecycle <string>` | auto_delete: the record goes autoDeleteAfterDays after the VM stops. keep: never removed automatically. |
+| `--auto-delete-after-days <integer>` | Days stopped before the record is deleted (0–365; 0 deletes it when it stops). Null writes the platform default. Not with keep. |
 
-MCP tool: `snapshots_create`.
+MCP tool: `vm_update`.
 
-### `ghostdock snapshots delete`
+### `ghostdock vm url`
 
-Permanently delete an organization snapshot (provider artifact and record).
+URLs that expose VM ports.
+
+### `ghostdock vm url create`
+
+Expose a VM port as a URL. Idempotent by port: when the VM already has a URL on that port, it is returned unchanged (autoWake, public and title are not applied); use vm url update to change it. HTTP defaults to private with no wake-on-visit; TCP URLs use TLS (not HTTP) and are always public — for a private port use vm ssh get and an SSH forward. Read the vm skill (`ghostdock skill get vm`) for TCP clients.
 
 ```
-ghostdock snapshots delete <snapshot-id> [flags]
+ghostdock vm url create <vm> --port <integer> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+| `--port <integer>` | Port inside the VM to expose. Required. |
+| `--protocol <string>` | "http" (default) or "tcp". TCP URLs use TLS and are always public. |
+| `--auto-wake` | Start the VM when the URL is visited while it is stopped. Default false. |
+| `--public` | Reachable without signing in. Default false; TCP URLs are always public. |
+| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the VM card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". |
 
-MCP tool: `snapshots_delete`.
+MCP tool: `vm_url_create`.
 
-### `ghostdock snapshots get`
+### `ghostdock vm url delete`
 
-Get one snapshot with its manifest and required environment, URLs and MCPs. Returns a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. Poll it after snapshots create while status is pending.
+Delete a VM URL.
 
 ```
-ghostdock snapshots get <snapshot-id> [flags]
+ghostdock vm url delete <url-id>
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<url-id>` | VM URL id, from vm url list or vm url create. Required. |
 
-MCP tool: `snapshots_get`.
+MCP tool: `vm_url_delete`.
 
-### `ghostdock snapshots list`
+### `ghostdock vm url list`
 
-List the snapshots an organization can boot sandboxes from. Each item has status (pending, active, error), the provider that holds it (sandboxProviderId; boot it there), sandboxCount, and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps.
+List the URLs that expose a VM’s ports, with protocol, access and title. A titled URL (for example `Desktop`, the desktop image’s desktop in a browser) gets its own button in the app.
 
 ```
-ghostdock snapshots list [flags]
+ghostdock vm url list <vm> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
 
-MCP tool: `snapshots_list`.
+MCP tool: `vm_url_list`.
 
-### `ghostdock snapshots update-manifest`
+### `ghostdock vm url update`
 
-Replace a snapshot’s manifest (URLs, environment, MCPs). Does not change the snapshot itself. Secret values in the body are stored encrypted; the response is redacted. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
+Change a VM URL’s port, protocol, autoWake, public setting or title. TCP cannot be private.
 
 ```
-ghostdock snapshots update-manifest <snapshot-id> --manifest <object> [flags]
+ghostdock vm url update <url-id> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--manifest <object>` | The new manifest; replaces the stored one. An omitted ephemeral keeps the stored value. Secret values are stored encrypted. (JSON object) Required. |
+| `<url-id>` | VM URL id, from vm url list or vm url create. Required. |
+| `--port <integer>` | New port inside the VM. Omit to keep it. |
+| `--protocol <string>` | "http" or "tcp". Omit to keep the current protocol. |
+| `--auto-wake` | Start the VM when the URL is visited while it is stopped. Omit to keep it. |
+| `--public` | Reachable without signing in. Omit to keep it; TCP cannot be made private. |
+| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the VM card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". Omit to keep it; null removes it. |
 
-MCP tool: `snapshots_update_manifest`.
+MCP tool: `vm_url_update`.
 
-## `ghostdock tools`
+### `ghostdock vm wake`
 
-List available agent tools.
+Start a stopped VM, or reset the idle-stop countdown of a running one. Returns status, idleStopsAt / deletesAt, and `boot` (VM and container start times in ms; null when it was already running).
 
 ```
-ghostdock tools
+ghostdock vm wake <vm> [flags]
 ```
 
+| Argument | Description |
+| --- | --- |
+| `<vm>` | VM name (e.g. quiet-harbor) or id, from vm list or vm create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organization list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organization use`. |
+
+MCP tool: `vm_wake`.
+
 ## `ghostdock whoami`
 
 Show the account this CLI is currently authenticated as.